Wireless communications operating according to a predetermined protocol, such as Wireless Fidelity (Wi-Fi) and broadband wireless access, are gaining worldwide popularity for constructing area networks. The advantages of the wireless medium include the capacity to address broad geographic areas without expensive infrastructure development such as running cables. The broadband wireless access industry is guided by IEEE standard 802.16, with its Wireless Metropolitan Area Networks (WirelessMAN) air interface, for wide area networks. The WirelessMAN interface provides an alternative to cabled access networks, such as a digital subscriber line (DSL). The current version of the IEEE standard 802.16 is IEEE Std 802.16e-2005, which amends IEEE Std 802.16d-2004 by adding mobility capabilities to the standard.
IEEE Std 802.16j, which is currently being developed, introduces new components referred to as “Relay Stations (RS)” as an addition to Base Stations (BS) and Subscriber Stations (SS). IEEE Std 802.16j aims to support multi-hop transmissions via RSs within a BS cell and therefore to provide user throughput enhancement and coverage extension in the networks. The RS can be deployed as a Fixed RS (FRS), a Nomadic RS (NRS), and/or a Mobile RS (MRS). The FRS covers outdoor fixed infrastructure and/or in-building coverage extensions; the NRS is developed for temporary coverage in case of events with large people gathering or disasters; and the MRS is mounted on a mobile vehicle such as a bus or train. An MRS connects to a BS or FRS via a wireless link and acts as a FRS to provide a fixed access link to the SSs on board the mobile vehicle.
IEEE Std 802.16e supports two distinct authentication protocols, i.e., an RSA protocol and an Extensible Authentication Protocol (EAP). The RSA authentication protocol utilizes X.509 digital certificates and the RSA public key encryption algorithm that binds public RSA encryption keys to a Media Access Control (MAC) address of the SS. Generally speaking, the FRS and the NRS take the RSA authentication protocol to carry out a mutual authentication procedure and establish an authentication key.
For example, the FRS begins the RSA authentication by sending an Authentication Information message to its serving BS. The Authentication Information message contains the FRS's X.509 certificate and provides a mechanism for the BS to learn the certificate of its client FRS. The FRS further sends an Authentication Request message to its serving BS immediately after sending the Authentication Information message. This is a request for an authentication key (AK), as well as for security association identifications (SAID) identifying any security association (SA) the SS is authorized to participate in. The Authentication Request message sent to the serving BS includes: the X.509 certificate, a description of a cryptographic algorithm and a basic connection ID. In response to the Authentication Request message, the serving BS validates the requesting FRS's identity via the X.509 digital certificate, determines the encryption algorithm and protocol support it shares with the FRS, activates an authentication key (AK) for the FRS, encrypts it with the FRS's public key, and sends it back to the FRS in an Authentication Reply message. The Authentication Reply message includes: the AK, a sequence number, a key lifetime, and a security association ID.
Different from the FRS and the NRS, the MRS is allowed to travel across multiple BSs, so it may handoff into or out of networks when the vehicle arrives at or departs from the coverage area of a BS. Before the handoff into a new network, the MRS should perform mutual authentication with the prospective serving BS and establish an authentication key between the prospective serving BS and itself. The MRS takes an Extensible Authentication Protocol (EAP) authentication to execute the authentication procedure and authentication key establishment. The EAP is used in conjunction with an operator-selected EAP method, such as an Extensible Authentication Protocol-Transport Level Security (EAP-TLS) method. Traditionally, the MRS can perform either Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) authentication or Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) authentication to complete the mutual authentication and the authentication key establishment with the serving BS. The EAP-SIM authentication protocol takes account of security issues and employs security measures to provide user authentication and data confidentiality in wireless environments. The EAP-AKA authentication protocol retains the framework of the EAP-SIM authentication protocol to provide mutual authentication between the BS and the MRS, and generates a fresh authentication vector upon successful authentication.
However, due to frequent MRS handoffs, a handoff latency of the EAP authentication gets longer. In addition, it has been found that the EAP-SIM authentication and the EAP-AKA authentication may have some weaknesses, including: (i) bandwidth consumption between the BS and its authentication server (AS) during multiple MRSs perform handoffs; (ii) large storage space usage for storing authentication data in the BS; and (iii) a need for synchronization between the MRS and its AS.